Tighten built-in upload metadata file validation

[adamziel]

What it does

Holds attachments with missing or empty _wp_attachment_metadata.file as built-in WordPress upload conflicts. The existing discovered media validator already caught this shape; now the production WordPress-scoped validator reports it directly as plugin-wp-attachment-upload-metadata-file-drift.

Also refreshes the merge reliability release-gate evidence from v0.1.40 to the newly published v0.1.41 release.

Rationale

A merged attachment can have _wp_attached_file and serialized metadata but still lack the metadata-side original file field. WordPress uses that field when reasoning about media derivatives, so a generic merge should not treat the state as coherent or silently pick a regeneration policy.

Implementation

When built-in upload validation sees readable attachment metadata without a usable file field, it records a review-only conflict with:

• field: _wp_attachment_metadata.file
• role: metadata-file
• metadata_file_present
• metadata_file
• the referenced _wp_attached_file path

Testing instructions

php -l scripts/cow/merge.php
php -l tests/cow/media_validator.php
php tests/cow/media_validator.php
git diff --check